Digital Asset Business (Cyber Risk) Rules 2023

Summary

These Rules, made by the Bermuda Monetary Authority under the Digital Asset Business Act 2018, set out cyber risk reporting requirements for licensed digital asset business undertakings. They replace the 2018 cybersecurity rules and took effect on 1 January 2024.

• Cyber risk return: Class F licence holders must file a written cyber risk return with the Authority annually; Class M and Class T licence holders must file on a date determined by the Authority.
• Form of return: The return must be in the form directed by the Authority, as published on the BMA website.
• Declaration requirement: Each cyber risk return must be accompanied by a declaration, signed by the Chief Information Security Officer and a senior executive or director, confirming the return is accurate in all material respects to the best of their knowledge and belief.
• Revocation: The Digital Asset Business (Cybersecurity) Rules 2018 (BR 99/2018) are revoked and replaced by these Rules.

Key obligations

• Class F licence holders must file a written cyber risk return with the Authority annually.
• Class M and Class T licence holders must file a cyber risk return on the date determined by the Authority.
• Cyber risk returns must be submitted in the form directed by the Authority as published on www.bma.bm.
• Each cyber risk return must be accompanied by a declaration signed by the Chief Information Security Officer and a senior executive or director attesting to its accuracy.

Applies to

digital asset business licensees, Class F licence holders, Class M licence holders, Class T licence holders

Deadlines

• annually: Class F licence holders must file their cyber risk return annually.
• as determined by the Authority: Class M and Class T licence holders must file their cyber risk return on a date set by the Authority.
• 1 January 2024: Commencement date of these Rules.

Related documents

• This document is made under Digital Asset Business Act 2018